CVE-2026-40366: Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

PriorityP349high8.4CVSS 3.1

AVLACLPRNUINSUCHIHAH

EPSS

0.38%

30.7th percentile

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
microsoft	microsoft_365_apps_for_enterprise	>= 16.0.1 < https://aka.ms/OfficeSecurityReleases	https://aka.ms/OfficeSecurityReleases
microsoft	microsoft_office_2019	>= 19.0.0 < https://aka.ms/OfficeSecurityReleases	https://aka.ms/OfficeSecurityReleases
microsoft	microsoft_office_ltsc_2021	>= 16.0.1 < https://aka.ms/OfficeSecurityReleases	https://aka.ms/OfficeSecurityReleases
microsoft	microsoft_office_ltsc_2024	>= 16.0.0 < https://aka.ms/OfficeSecurityReleases	https://aka.ms/OfficeSecurityReleases
microsoft	microsoft_office_ltsc_for_mac_2021	>= 16.0.1 < 16.109.26051019	16.109.26051019
microsoft	microsoft_office_ltsc_for_mac_2024	>= 16.0.0 < 16.109.26051019	16.109.26051019
microsoft	microsoft_word_2016	>= 16.0.1 < 16.0.5552.1000	16.0.5552.1000
microsoft	office	—	—
microsoft	office_long_term_servicing_channel	—	—
microsoft	office_long_term_servicing_channel	—	—
microsoft	word	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.